diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2019-06-02 09:48:05 +0200 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2019-06-02 11:23:54 +0200 |
commit | 717ccfd957e686d773480df817387aebbe79aa48 (patch) | |
tree | b2f59c57da32dcafefee9ccc5d7e6d32e498721e /modules/private/websites/aten | |
parent | 29f8cb850d74b456d6481a456311bbf5361d328c (diff) | |
download | Nix-717ccfd957e686d773480df817387aebbe79aa48.tar.gz Nix-717ccfd957e686d773480df817387aebbe79aa48.tar.zst Nix-717ccfd957e686d773480df817387aebbe79aa48.zip |
Finish moving aten php configuration to dedicated module
Diffstat (limited to 'modules/private/websites/aten')
-rw-r--r-- | modules/private/websites/aten/builder.nix | 100 | ||||
-rw-r--r-- | modules/private/websites/aten/integration.nix | 78 | ||||
-rw-r--r-- | modules/private/websites/aten/production.nix | 89 |
3 files changed, 126 insertions, 141 deletions
diff --git a/modules/private/websites/aten/builder.nix b/modules/private/websites/aten/builder.nix deleted file mode 100644 index 83a8f70..0000000 --- a/modules/private/websites/aten/builder.nix +++ /dev/null | |||
@@ -1,100 +0,0 @@ | |||
1 | { apacheUser, apacheGroup, aten, lib, mylibs, config }: rec { | ||
2 | app = aten.override { inherit (config) environment; }; | ||
3 | phpFpm = rec { | ||
4 | preStart = mylibs.phpFpmPreStart { | ||
5 | inherit app; | ||
6 | inherit (app) varDir; | ||
7 | keyFiles = [ | ||
8 | "/var/secrets/webapps/${app.environment}-aten" | ||
9 | ]; | ||
10 | actions = [ | ||
11 | "/run/wrappers/bin/sudo -u ${apacheUser} APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup" | ||
12 | ]; | ||
13 | }; | ||
14 | serviceDeps = [ "postgresql.service" ]; | ||
15 | socket = "/var/run/phpfpm/aten-${app.environment}.sock"; | ||
16 | pool = '' | ||
17 | listen = ${socket} | ||
18 | user = ${apacheUser} | ||
19 | group = ${apacheGroup} | ||
20 | listen.owner = ${apacheUser} | ||
21 | listen.group = ${apacheGroup} | ||
22 | php_admin_value[upload_max_filesize] = 20M | ||
23 | php_admin_value[post_max_size] = 20M | ||
24 | ;php_admin_flag[log_errors] = on | ||
25 | php_admin_value[open_basedir] = "${app}:${app.varDir}:/tmp" | ||
26 | php_admin_value[session.save_path] = "${app.varDir}/phpSessions" | ||
27 | ${if app.environment == "dev" then '' | ||
28 | pm = ondemand | ||
29 | pm.max_children = 5 | ||
30 | pm.process_idle_timeout = 60 | ||
31 | env[SYMFONY_DEBUG_MODE] = "yes" | ||
32 | '' else '' | ||
33 | pm = dynamic | ||
34 | pm.max_children = 20 | ||
35 | pm.start_servers = 2 | ||
36 | pm.min_spare_servers = 1 | ||
37 | pm.max_spare_servers = 3 | ||
38 | ''}''; | ||
39 | }; | ||
40 | keys = [{ | ||
41 | dest = "webapps/${app.environment}-aten"; | ||
42 | user = apacheUser; | ||
43 | group = apacheGroup; | ||
44 | permissions = "0400"; | ||
45 | text = '' | ||
46 | SetEnv APP_ENV "${app.environment}" | ||
47 | SetEnv APP_SECRET "${config.secret}" | ||
48 | SetEnv DATABASE_URL "${config.psql_url}" | ||
49 | ''; | ||
50 | }]; | ||
51 | apache = rec { | ||
52 | modules = [ "proxy_fcgi" ]; | ||
53 | webappName = "aten_${app.environment}"; | ||
54 | root = "/run/current-system/webapps/${webappName}"; | ||
55 | vhostConf = '' | ||
56 | <FilesMatch "\.php$"> | ||
57 | SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost" | ||
58 | </FilesMatch> | ||
59 | |||
60 | Include /var/secrets/webapps/${app.environment}-aten | ||
61 | |||
62 | ${if app.environment == "dev" then '' | ||
63 | <Location /> | ||
64 | Use LDAPConnect | ||
65 | Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
66 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
67 | </Location> | ||
68 | |||
69 | <Location /backend> | ||
70 | Use LDAPConnect | ||
71 | Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
72 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
73 | </Location> | ||
74 | '' else '' | ||
75 | Use Stats aten.pro | ||
76 | |||
77 | <Location /backend> | ||
78 | Use LDAPConnect | ||
79 | Require ldap-group cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
80 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
81 | </Location> | ||
82 | ''} | ||
83 | |||
84 | <Directory ${root}> | ||
85 | Options Indexes FollowSymLinks MultiViews Includes | ||
86 | AllowOverride All | ||
87 | Require all granted | ||
88 | DirectoryIndex index.php | ||
89 | FallbackResource /index.php | ||
90 | </Directory> | ||
91 | ''; | ||
92 | }; | ||
93 | activationScript = { | ||
94 | deps = [ "wrappers" ]; | ||
95 | text = '' | ||
96 | install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} | ||
97 | install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions | ||
98 | ''; | ||
99 | }; | ||
100 | } | ||
diff --git a/modules/private/websites/aten/integration.nix b/modules/private/websites/aten/integration.nix index 0dbc4fa..38068a7 100644 --- a/modules/private/websites/aten/integration.nix +++ b/modules/private/websites/aten/integration.nix | |||
@@ -1,43 +1,83 @@ | |||
1 | { lib, pkgs, config, myconfig, ... }: | 1 | { lib, pkgs, config, myconfig, ... }: |
2 | let | 2 | let |
3 | aten = pkgs.callPackage ./builder.nix { | 3 | secrets = myconfig.env.websites.aten.integration; |
4 | inherit (pkgs.webapps) aten; | 4 | app = pkgs.webapps.aten.override { environment = secrets.environment; }; |
5 | config = myconfig.env.websites.aten.integration; | ||
6 | apacheUser = config.services.httpd.Inte.user; | ||
7 | apacheGroup = config.services.httpd.Inte.group; | ||
8 | }; | ||
9 | |||
10 | cfg = config.myServices.websites.aten.integration; | 5 | cfg = config.myServices.websites.aten.integration; |
6 | pcfg = config.services.phpApplication; | ||
11 | in { | 7 | in { |
12 | options.myServices.websites.aten.integration.enable = lib.mkEnableOption "enable Aten's website in integration"; | 8 | options.myServices.websites.aten.integration.enable = lib.mkEnableOption "enable Aten's website in integration"; |
13 | 9 | ||
14 | config = lib.mkIf cfg.enable { | 10 | config = lib.mkIf cfg.enable { |
15 | services.phpApplication.aten_dev = let | 11 | services.phpApplication.apps.aten_dev = { |
16 | app = pkgs.webapps.aten.override { environment = "dev"; }; | ||
17 | in { | ||
18 | websiteEnv = "integration"; | 12 | websiteEnv = "integration"; |
19 | httpdUser = config.services.httpd.Inte.user; | 13 | httpdUser = config.services.httpd.Inte.user; |
20 | httpdGroup = config.services.httpd.Inte.group; | 14 | httpdGroup = config.services.httpd.Inte.group; |
15 | httpdWatchFiles = [ | ||
16 | config.secrets.fullPaths."webapps/${app.environment}-aten" | ||
17 | ]; | ||
21 | inherit (app) webRoot varDir; | 18 | inherit (app) webRoot varDir; |
22 | inherit app; | 19 | inherit app; |
23 | serviceDeps = [ "postgresql.service" ]; | 20 | serviceDeps = [ "postgresql.service" ]; |
24 | preStartActions = [ | 21 | preStartActions = [ |
25 | "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup" | 22 | "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup" |
26 | ]; | 23 | ]; |
27 | watchFiles = [ | 24 | phpOpenbasedir = [ "/tmp" ]; |
28 | "${config.secrets.location}/webapps/${app.environment}-aten" | 25 | phpPool = '' |
29 | ]; | 26 | php_admin_value[upload_max_filesize] = 20M |
30 | webappName = "aten_dev"; | 27 | php_admin_value[post_max_size] = 20M |
28 | ;php_admin_flag[log_errors] = on | ||
29 | pm = ondemand | ||
30 | pm.max_children = 5 | ||
31 | pm.process_idle_timeout = 60 | ||
32 | env[SYMFONY_DEBUG_MODE] = "yes" | ||
33 | ''; | ||
31 | }; | 34 | }; |
32 | 35 | ||
33 | secrets.keys = aten.keys; | 36 | secrets.keys = [{ |
34 | services.phpfpm.poolConfigs.aten_dev = aten.phpFpm.pool; | 37 | dest = "webapps/${app.environment}-aten"; |
35 | services.websites.env.integration.vhostConfs.aten = { | 38 | user = config.services.httpd.Inte.user; |
39 | group = config.services.httpd.Inte.user; | ||
40 | permissions = "0400"; | ||
41 | text = '' | ||
42 | SetEnv APP_ENV "${app.environment}" | ||
43 | SetEnv APP_SECRET "${secrets.secret}" | ||
44 | SetEnv DATABASE_URL "${secrets.psql_url}" | ||
45 | ''; | ||
46 | }]; | ||
47 | services.websites.env.integration.vhostConfs.aten_dev = { | ||
36 | certName = "eldiron"; | 48 | certName = "eldiron"; |
37 | addToCerts = true; | 49 | addToCerts = true; |
38 | hosts = [ "dev.aten.pro" ]; | 50 | hosts = [ "dev.aten.pro" ]; |
39 | root = aten.apache.root; | 51 | root = pcfg.webappDirs.aten_dev; |
40 | extraConfig = [ aten.apache.vhostConf ]; | 52 | extraConfig = [ |
53 | '' | ||
54 | <FilesMatch "\.php$"> | ||
55 | SetHandler "proxy:unix:${pcfg.phpListenPaths.aten_dev}|fcgi://localhost" | ||
56 | </FilesMatch> | ||
57 | |||
58 | Include ${config.secrets.fullPaths."webapps/${app.environment}-aten"} | ||
59 | |||
60 | <Location /> | ||
61 | Use LDAPConnect | ||
62 | Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
63 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
64 | </Location> | ||
65 | |||
66 | <Location /backend> | ||
67 | Use LDAPConnect | ||
68 | Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
69 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
70 | </Location> | ||
71 | |||
72 | <Directory ${pcfg.webappDirs.aten_dev}> | ||
73 | Options Indexes FollowSymLinks MultiViews Includes | ||
74 | AllowOverride All | ||
75 | Require all granted | ||
76 | DirectoryIndex index.php | ||
77 | FallbackResource /index.php | ||
78 | </Directory> | ||
79 | '' | ||
80 | ]; | ||
41 | }; | 81 | }; |
42 | }; | 82 | }; |
43 | } | 83 | } |
diff --git a/modules/private/websites/aten/production.nix b/modules/private/websites/aten/production.nix index 0fab309..21ecdcf 100644 --- a/modules/private/websites/aten/production.nix +++ b/modules/private/websites/aten/production.nix | |||
@@ -1,36 +1,81 @@ | |||
1 | { lib, pkgs, config, myconfig, ... }: | 1 | { lib, pkgs, config, myconfig, ... }: |
2 | let | 2 | let |
3 | aten = pkgs.callPackage ./builder.nix { | 3 | secrets = myconfig.env.websites.aten.production; |
4 | inherit (pkgs.webapps) aten; | 4 | app = pkgs.webapps.aten.override { environment = secrets.environment; }; |
5 | config = myconfig.env.websites.aten.production; | ||
6 | apacheUser = config.services.httpd.Prod.user; | ||
7 | apacheGroup = config.services.httpd.Prod.group; | ||
8 | }; | ||
9 | |||
10 | cfg = config.myServices.websites.aten.production; | 5 | cfg = config.myServices.websites.aten.production; |
6 | pcfg = config.services.phpApplication; | ||
11 | in { | 7 | in { |
12 | options.myServices.websites.aten.production.enable = lib.mkEnableOption "enable Aten's website in production"; | 8 | options.myServices.websites.aten.production.enable = lib.mkEnableOption "enable Aten's website in production"; |
13 | 9 | ||
14 | config = lib.mkIf cfg.enable { | 10 | config = lib.mkIf cfg.enable { |
15 | secrets.keys = aten.keys; | ||
16 | services.webstats.sites = [ { name = "aten.pro"; } ]; | 11 | services.webstats.sites = [ { name = "aten.pro"; } ]; |
12 | services.phpApplication.apps.aten_prod = { | ||
13 | websiteEnv = "production"; | ||
14 | httpdUser = config.services.httpd.Prod.user; | ||
15 | httpdGroup = config.services.httpd.Prod.group; | ||
16 | httpdWatchFiles = [ | ||
17 | config.secrets.fullPaths."webapps/${app.environment}-aten" | ||
18 | ]; | ||
19 | inherit (app) webRoot varDir; | ||
20 | inherit app; | ||
21 | serviceDeps = [ "postgresql.service" ]; | ||
22 | preStartActions = [ | ||
23 | "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup" | ||
24 | ]; | ||
25 | phpOpenbasedir = [ "/tmp" ]; | ||
26 | phpPool = '' | ||
27 | php_admin_value[upload_max_filesize] = 20M | ||
28 | php_admin_value[post_max_size] = 20M | ||
29 | ;php_admin_flag[log_errors] = on | ||
30 | pm = dynamic | ||
31 | pm.max_children = 20 | ||
32 | pm.start_servers = 2 | ||
33 | pm.min_spare_servers = 1 | ||
34 | pm.max_spare_servers = 3 | ||
35 | ''; | ||
36 | }; | ||
17 | 37 | ||
18 | systemd.services.phpfpm-aten_prod.preStart = lib.mkAfter aten.phpFpm.preStart; | 38 | secrets.keys = [{ |
19 | systemd.services.phpfpm-aten_prod.after = lib.mkAfter aten.phpFpm.serviceDeps; | 39 | dest = "webapps/${app.environment}-aten"; |
20 | systemd.services.phpfpm-aten_prod.wants = aten.phpFpm.serviceDeps; | 40 | user = config.services.httpd.Prod.user; |
21 | services.phpfpm.poolConfigs.aten_prod = aten.phpFpm.pool; | 41 | group = config.services.httpd.Prod.user; |
22 | system.activationScripts.aten_prod = aten.activationScript; | 42 | permissions = "0400"; |
23 | myServices.websites.webappDirs."${aten.apache.webappName}" = aten.app.webRoot; | 43 | text = '' |
24 | services.websites.env.production.modules = aten.apache.modules; | 44 | SetEnv APP_ENV "${app.environment}" |
25 | services.websites.env.production.vhostConfs.aten = { | 45 | SetEnv APP_SECRET "${secrets.secret}" |
46 | SetEnv DATABASE_URL "${secrets.psql_url}" | ||
47 | ''; | ||
48 | }]; | ||
49 | services.websites.env.production.vhostConfs.aten_prod = { | ||
26 | certName = "aten"; | 50 | certName = "aten"; |
27 | certMainHost = "aten.pro"; | 51 | certMainHost = "aten.pro"; |
28 | hosts = [ "aten.pro" "www.aten.pro" ]; | 52 | hosts = [ "aten.pro" "www.aten.pro" ]; |
29 | root = aten.apache.root; | 53 | root = pcfg.webappDirs.aten_prod; |
30 | extraConfig = [ aten.apache.vhostConf ]; | 54 | extraConfig = [ |
55 | '' | ||
56 | <FilesMatch "\.php$"> | ||
57 | SetHandler "proxy:unix:${pcfg.phpListenPaths.aten_prod}|fcgi://localhost" | ||
58 | </FilesMatch> | ||
59 | |||
60 | Include ${config.secrets.fullPaths."webapps/${app.environment}-aten"} | ||
61 | |||
62 | Use Stats aten.pro | ||
63 | |||
64 | <Location /backend> | ||
65 | Use LDAPConnect | ||
66 | Require ldap-group cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
67 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
68 | </Location> | ||
69 | |||
70 | <Directory ${pcfg.webappDirs.aten_prod}> | ||
71 | Options Indexes FollowSymLinks MultiViews Includes | ||
72 | AllowOverride All | ||
73 | Require all granted | ||
74 | DirectoryIndex index.php | ||
75 | FallbackResource /index.php | ||
76 | </Directory> | ||
77 | '' | ||
78 | ]; | ||
31 | }; | 79 | }; |
32 | services.websites.env.production.watchPaths = [ | ||
33 | "/var/secrets/webapps/${aten.app.environment}-aten" | ||
34 | ]; | ||
35 | }; | 80 | }; |
36 | } | 81 | } |